CVE-2026-26231

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write...

CVE-2025-68939

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API...

CVE-2022-1058

Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5...

GO-2022-0309 Cross Site Request Forgery in Gitea in github.com/go-gitea/gitea

Cross Site Request Forgery in Gitea in github.com/go-gitea/gitea...

PT-2024-5577 · Gitea · Gitea

Name of the Vulnerable Software and Affected Versions: Gitea Open Source Git Server version 1.22.0 Description: The issue affects Gitea Open Source Git Server due to improper neutralization of input during web page generation, allowing Stored XSS. This can enable a remote attacker to conduct a...

Remote Code Execution (RCE)

github.com/go-gitea/gitea is vulnerable to remote code execution. The vulnerability exists because of the reliance on protection mechanism of HTTP permission methods, allowing an attacker to bypass intended access restrictions and to perform the malicious operations remotely...